Council Decision (EU) 2021/1093 of 28 June 2021 laying down implementing rules concerning the Data Protection Officer of the Council, the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and restrictions of data subjects’ rights in the context of the exercise of the tasks of the Data Protection Officer of the Council, and repealing Council Decision 2004/644/EC
Council Decision (EU) 2021/1093 of 28 June 2021 laying down implementing rules concerning the Data Protection Officer of the Council, the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and restrictions of data subjects’ rights in the context of the exercise of the tasks of the Data Protection Officer of the Council, and repealing Council Decision 2004/644/EC
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 240(3) thereof,
Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC(1), and in particular Article 45(3) thereof,
Whereas:
Regulation (EU) 2018/1725 sets out principles and rules applicable to all Union institutions and bodies and provides for the appointment by each Union institution or body of a data protection officer.
Article 45(3) of Regulation (EU) 2018/1725 requires the adoption of implementing rules concerning the data protection officer by each Union institution or body (the ‘implementing rules’). The implementing rules should in particular concern the tasks, duties and powers of the Data Protection Officer of the Council and of the General Secretariat of the Council (‘DPO’).
The implementing rules should lay down the procedures for the exercise of the rights of the data subjects and for the fulfilment of the obligations of all relevant actors within the Council and the General Secretariat of the Council (‘GSC’) relating to the processing of personal data.
Regulation (EU) 2018/1725 provides for clear responsibilities of data controllers, in particular with regard to the rights of data subjects. The implementing rules should ensure that the Council and the GSC fulfil their responsibilities as a controller in a uniform and transparent manner. Rules should be set out in order to identify who is responsible for a processing operation which is carried out on behalf of the Council or the GSC. In this respect, it is appropriate to introduce the concept of a ‘delegated controller’ in order to indicate precisely the responsibilities of the entities of the GSC, in particular as regards individual decisions concerning data subjects’ rights. In addition, it is appropriate to introduce the concept of an ‘operational controller’ who, under the responsibility of the delegated controller, is designated to ensure compliance in practice, and to process requests from data subjects with regard to a processing operation. In order to indicate precisely the responsibilities in the GSC for each processing activity, the operational controller should be indicated precisely in the record kept in the register. The appointment of an operational controller does not prevent the use in practice of a contact point, for example in the form of a functional mailbox to be made available for data subjects’ requests.
In certain cases, several GSC directorates-general or services jointly carry out a processing operation in order to fulfil their mission. In such cases, they should ensure that internal arrangements are in place in order to determine in a transparent manner their respective responsibilities under Regulation (EU) 2018/1725, in particular with regard to the rights of the data subjects, notification to the European Data Protection Supervisor (‘EDPS’) and record keeping.
In order to facilitate the exercise of the responsibilities of the delegated controllers, each GSC directorate-general or other service should appoint a data protection coordinator. The data protection coordinators should assist the GSC directorate-general or other service in all aspects of the protection of personal data and participate in the network of data protection coordinators in the GSC in order to ensure coherent implementation and interpretation of Regulation (EU) 2018/1725.
Pursuant to point (b) of Article 45(1) of Regulation (EU) 2018/1725, the DPO could issue additional guidance on the function of the data protection coordinator.
Article 25(1) of Regulation (EU) 2018/1725 provides each Union institution or body with the possibility to restrict the application of Articles 14 to 17, 19, 20 and 35 of that Regulation, as well as the principle of transparency laid down in Article 4(1), point (a), thereof, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation.
In certain cases, the DPO may need to restrict data subjects’ rights in order to perform the monitoring, investigative, auditing or consultative tasks set out in Article 45 of Regulation (EU) 2018/1725 while respecting the standards of protection of personal data under that Regulation. It is necessary to adopt internal rules under which the DPO may restrict data subjects’ rights in accordance with Article 25 thereof (the ‘internal rules’).
The internal rules should apply to all data processing operations carried out by the Council and the GSC in the performance of the monitoring, investigative, auditing or consultative tasks of the DPO. The internal rules should also apply to processing operations which form part of the tasks linked to the investigative or auditing function of the DPO, such as complaint processes conducted by the DPO. The internal rules should also apply to the monitoring of the DPO and the consultations of the DPO where the DPO provides assistance and cooperation to GSC directorates-general and services outside of its administrative investigations and audits.
The Council and the GSC may need to apply restrictions based on the grounds referred to in Article 25(1), points (c), (g) and (h), of Regulation (EU) 2018/1725 to data processing operations carried out in the framework of the monitoring, investigative, auditing or consultative tasks of the DPO when it is necessary to protect the tasks of the DPO, related investigations and proceedings, the tools and methods of DPO investigations and audits, as well as the rights of other persons related to the tasks of the DPO.
In order to maintain effective cooperation, the Council and the GSC may need to apply restrictions to data subjects’ rights to protect information containing personal data originating from other GSC directorates-general and services, or other Union institutions or bodies. To that effect, the DPO should consult those directorates-general and services or other institutions or bodies on the relevant grounds for, and on the necessity and proportionality of, such restrictions.
The DPO and, where relevant, GSC directorates-general and services should handle all restrictions in a transparent manner and register each application of restrictions in the corresponding record system.
Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the controllers may defer or refrain from providing information on the reasons for the application of a restriction to the data subject if this would in any way compromise the purpose of the restriction. In particular, where a restriction of the rights provided for in Articles 16 and 35 of that Regulation is applied, the notification of such a restriction would compromise the purpose of the restriction. In order to ensure that the data subject’s right to be informed in accordance with those Articles is restricted only as long as the reasons for the deferral last, the DPO or the GSC directorate-general or service applying the restriction should regularly review its position.
Where a restriction of other data subjects’ rights is applied, the DPO should assess, on a case-by-case basis, whether the communication of the restriction would compromise its purpose.
The DPO should carry out an independent review of the application of restrictions based on this Decision by other GSC directorates-general or services, with a view to ensuring compliance with this Decision.
Any restriction applied on the basis of this Decision should be necessary and proportionate in a democratic society.
The EDPS was informed and consulted in accordance with Article 41(1) and (2) of Regulation (EU) 2018/1725 and delivered an opinion(2).
The implementing rules of Regulation (EU) 2018/1725 are without prejudice to Regulation (EC) No 1049/2001 of the European Parliament and of the Council(3), to Council Decision 2004/338/EC, Euratom(4), and in particular Annex II thereto, to Council Decision 2013/488/EU(5), and in particular Section VI of Part II of the Annex thereto, as well as to the Decision of the Secretary-General of the Council/High Representative for Common Foreign and Security Policy of 25 June 2001(6).
Council Decision 2004/644/EC(7) lays down implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council. Regulation (EU) 2018/1725 repealed Regulation (EC) No 45/2001 with effect from 11 December 2019. In order to ensure that only one set of implementing rules is applicable, Decision 2004/644/EC should be repealed,
HAS ADOPTED THIS DECISION:
SECTION 1 GENERAL PROVISIONS
Article 1 Subject matter and scope
This Decision lays down rules and procedures for the application of Regulation (EU) 2018/1725 by the Council and the General Secretariat of the Council (GSC) and sets out further implementing rules concerning the Data Protection Officer of the Council (DPO).
This Decision lays down the rules to be followed by the Council and the GSC, in relation to the monitoring, investigative, auditing or consultative tasks of the DPO, when informing data subjects of the processing of their personal data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725.
This Decision lays down the conditions under which the Council and the GSC, in relation to the monitoring, investigative, auditing or consultative activities of the DPO, may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of the Regulation (EU) 2018/1725, in accordance with Article 25(1), points (c), (g) and (h), of that Regulation.
This Decision applies to the processing of personal data by the Council and the GSC for the purpose of or in relation to the tasks of the DPO referred to in Article 45 of Regulation (EU) 2018/1725.
Article 2 Controllership
For the purposes of this Decision, the Council and the GSC shall be considered to be the controller within the meaning of Article 3, point (8), of Regulation (EU) 2018/1725.
Article 3 Definitions
For the purposes of this Decision, the following definitions apply:
-
‘Data Protection Officer’ (DPO) means the person designated by the Secretary-General of the Council pursuant to Article 43 of Regulation (EU) 2018/1725;
-
‘DPO tasks’ means the tasks referred to in Article 45 of Regulation (EU) 2018/1725;
-
‘GSC staff’ means all GSC officials and any other person covered by the Staff Regulations of officials of the European Union and the Conditions of Employment of other servants of the Union, laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68(8) (the ‘Staff Regulations’), or working for the GSC on a contractual basis (namely trainees, consultants, contractors, officials seconded by Member States);
-
‘delegated controller’ means the head of the GSC directorate-general or service which, alone or jointly with others, determines the purposes and means of the processing of personal data on behalf of the Council or the GSC in fulfilment of the mission of that directorate-general or service;
-
‘operational controller’ means the GSC staff member at middle or senior management level who is designated by the delegated controller to assist him or her in ensuring compliance with Regulation (EU) 2018/1725 for the processing operations for which he or she is responsible, and to serve as the primary contact point for data subjects;
-
‘data protection coordinator’ means the GSC staff member designated in each GSC directorate-general or other service in consultation with the DPO to assist that directorate-general or service in all aspects of the protection of personal data and to deal as its representative with data protection issues in close cooperation with the DPO.